The bugfix for bug https://bugzilla.samba.org/show_bug.cgi?id=7909 unconditionally adds the SYNCHRONIZE flag to an ace mask. This should only be done for ALLOW ace entries, not for DENY entries.
Reported by Youzhong Yang, fix to follow.
Jeremy.